Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T21:18:02.037Z",
  "pubdate": "2026-08-18T21:18:02.037Z",
  "executiveSummary": "A security vulnerability affects the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically within the Endeca Application Controller component. The vulnerability is rated with a CVSS 3.1 Base Score of 6.1, highlighting risks to both data confidentiality and integrity. The issue allows an unauthenticated remote attacker with network access via HTTP to compromise the targeted system.\nSuccessful exploitation of this vulnerability requires human interaction from a user other than the attacker. Because of the architectural scope change associated with the vulnerability, successful attacks may significantly impact additional products beyond the primary Oracle Commerce Guided Search / Oracle Commerce Experience Manager installation. The direct impact includes unauthorized read access to a subset of accessible data, as well as unauthorized update, insert, or delete access to some of the accessible data within the application.\nOrganizations utilizing the affected software face notable risk if proper mitigations are not applied, as external unauthenticated entities can initiate attacks over the network provided the requisite user interaction occurs. Remediation requires strict adherence to vendor-supplied updates and hardening guidelines for the affected component.",
  "technicalDetails": "The vulnerability resides in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. Network exposure is present via the HTTP protocol, allowing remote attackers without prior authentication or privileges to interact with the vulnerable service.\nThe attack flow requires network access and relies on human interaction, meaning an authenticated or visiting user other than the attacker must perform a specific action to facilitate the attack vector, characteristic of web-based injection or cross-site scripting paradigms where client-side execution or state manipulation is triggered.\nUpon successful exploitation, the scope (S:C) of the vulnerability changes, indicating that the security scope alters beyond the immediate administrative boundary of the vulnerable component, potentially affecting downstream or integrated products within the Oracle Commerce architecture.\nThe resulting impact compromises data integrity and confidentiality (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Attackers can achieve unauthorized read access to a subset of data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager, while also gaining unauthorized capabilities to update, insert, or delete specific data records within the system."
}